CVE-2026-77931: MoviePilot 3.1.5 Command Injection via ExecuteCommandTool
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browsewebpage, searchweb, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.createsubprocessshell. Attackers can craft content that instructs the model to invoke executecommand with confirmdangerous set to true, bypassing the validatecommandsafety denylist and exploiting the admin session's isadmin context to achieve remote code execution on the host.
Affected Software
Event History
Frequently Asked Questions
What attacker interaction is required for exploitation?
An attacker must cause malicious instructions to be embedded in untrusted content that MoviePilot processes, such as web pages, search results, or torrent metadata. Exploitation relies on that content prompting the model to call execute_command with confirm_dangerous set to true.
What level of access does successful exploitation provide?
Successful exploitation can result in arbitrary operating-system command execution on the MoviePilot host. The commands execute in the context of an admin session because the vulnerable flow uses the admin is_admin context.
Does the attacker need an existing account or administrative privileges?
No privileges are required according to the supplied CVSS vector (PR:N). However, user interaction is required (UI:R), and the vulnerable processing flow ultimately operates through an admin session.
Which content-processing paths are implicated?
The affected flow includes untrusted content processed through tools such as browse_webpage, search_web, and torrent metadata parsers. That content can be passed to the unrestricted ExecuteCommandTool.